registry  /  spikeme  /  0.4.0

spikeme@0.4.0

Analyze your repo's stack and generate a time-boxed spike doc to decide your next library, with evidence. Reads package.json (npm) and pyproject.toml/requirements.txt (Python).

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 806 KB of source, external domains: api.spikeme.io, github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, spikeme.io, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

5 flagged · loading source
dist/index.jsView file
1004import { createHash, randomBytes } from "node:crypto"; L1005: import { spawn } from "node:child_process"; L1006: var WEB = process.env.SPIKEME_WEB ?? "https://spikeme.io";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1004
1004import { createHash, randomBytes } from "node:crypto"; L1005: import { spawn } from "node:child_process"; L1006: var WEB = process.env.SPIKEME_WEB ?? "https://spikeme.io"; L1007: var CLI_AUTH = `${SUPABASE_URL}/functions/v1/cli-auth`;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1004
15state: "Estado", L16: data: "Dados & Fetch", L17: forms: "Formul\xE1rios", ... L84: { match: "swr", label: "SWR", category: "data" }, L85: { match: "axios", label: "Axios", category: "data" }, L86: { match: "graphql", label: "GraphQL", category: "data" }, ... L176: try { L177: parsed = JSON.parse(raw); L178: } catch { ... L253: label: "npm", L254: manifests: ["package.json"], L255: detect: (filename) => manifestBasename(filename).toLowerCase() === "package.json",
High
Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15
15state: "Estado", L16: data: "Dados & Fetch", L17: forms: "Formul\xE1rios", ... L84: { match: "swr", label: "SWR", category: "data" }, L85: { match: "axios", label: "Axios", category: "data" }, L86: { match: "graphql", label: "GraphQL", category: "data" }, ... L176: try { L177: parsed = JSON.parse(raw); L178: } catch { ... L253: label: "npm", L254: manifests: ["package.json"], L255: detect: (filename) => manifestBasename(filename).toLowerCase() === "package.json",
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L15
dist/mcp.jsView file
2941sourceCode = this.opts.code.process(sourceCode, sch); L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2943: const validate = makeValidate(this, this.scope.get());
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L2941

Findings

5 High3 Medium6 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings